CVE-2016-2840

Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26 is affected. The issue arises from the session parameter on file-download requests, allowing injected script to be reflected on the subsequent status page and executed within a trusted domain’s context. Exploitation does not require authentic...